CVE-2026-110131

ThriveX-Server versions through 4.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the GET /api/article and /api/article/{id} endpoints. This flaw allows unauthenticated attackers to access non-public content, including unpublished drafts and soft-deleted articles . Expl...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

EUVD-2026-98895

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

PT-2026-111722

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131: Missing Authorization

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

PT-2026-83839

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::remove image checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-30452

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in...

CVE-2026-30452

Textpattern CMS version 4.9.0 is affected by a Broken Access Control vulnerability within its article management system. The root cause is an insufficient authorization check during the duplicate-and-save workflow located in textpattern/include/txp_article.php. An authenticated user with low priv...

CVE-2024-44839

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php...

paicoding security vulnerabilities

paicoding is an open source community system for itwanger individual developers. A security vulnerability exists in paicoding version 1.0.3, which stems from improper authorization due to misuse of the parameter articleId in the file /article/api/post...

Improper Access Control

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Improper Access Control where a low-privileged user can modify and delete admin articles by changing the value of the articleid parameter. Remediation...

PT-2022-14130 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify/publify versions prior to 9.2.9 Description: The issue allows a low-privileged user to bypass authorization and access sensitive information by manipulating a user-controlled key. Specifically, this can be achieved by modifying the...

WordPress plugin PostX Gutenberg Blocks Saved Templates Addon has a security vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin PostX...

CVE-2018-20589

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

CVE-2018-20589

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

PT-2018-15453

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS through 2018-04-28 Description The issue concerns a Cross-Site Scripting XSS flaw. It is exploitable via the Administrator/add pictures.php article ID. Recommendations For Ivan Cordoba Generic...

CVE-2018-20589: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...